Reverse Engineering for Beginners

(avery) #1

CHAPTER 80. SAP CHAPTER 80. SAP


Chapter 80


SAP


80.1 About SAP client network traffic compression


(Tracing the connection between the TDW_NOCOMPRESS SAPGUI^1 environment variable and the pesky annoying pop-up
window and the actual data compression routine.)


It is known that the network traffic between SAPGUI and SAP is not encrypted by default, but compressed (see here^2 and
here^3 ).


It is also known that by setting the environment variableTDW_NOCOMPRESSto 1, it is possible to turn the network packet
compression off.


But you will see a annoying pop-up window that cannot be closed:


Figure 80.1:Screenshot

Let’s see if we can remove the window somehow.


But before this, let’s see what we already know. First: we know that the environment variableTDW_NOCOMPRESSis checked
somewhere inside the SAPGUI client. Second: a string like “data compression switched off” must be present somewhere in
it. With the help of the FAR file manager^4 we can found that both of these strings are stored in the SAPguilib.dll file.


So let’s open SAPguilib.dll inIDAand search for the“TDW_NOCOMPRESS ”string. Yes, it is present and there is only one
reference to it.


We see the following fragment of code (all file offsets are valid for SAPGUI 720 win32, SAPguilib.dll file version 7200,1,0,9009):


(^1) SAP GUI client
(^2) http://go.yurichev.com/17221
(^3) blog.yurichev.com
(^4) http://go.yurichev.com/17347

Free download pdf